Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3dex.py
windows11-21h2-x64
index.html
windows11-21h2-x64
1launch.bat
windows11-21h2-x64
1objects.py
windows11-21h2-x64
3olympia.py
windows11-21h2-x64
3pyarmor_ru...t__.py
windows11-21h2-x64
3pyarmor_ru...12.pyc
windows11-21h2-x64
3pyarmor_ru...me.dll
windows11-21h2-x64
1synapse.py
windows11-21h2-x64
3Resubmissions
22/02/2024, 23:12
240222-2695bsgf99 322/02/2024, 23:07
240222-233wvagf86 822/02/2024, 23:03
240222-21plfagb6x 8Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
dex.py
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
index.html
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
launch.bat
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
objects.py
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
olympia.py
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
pyarmor_runtime_000000/__init__.py
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
pyarmor_runtime_000000/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
pyarmor_runtime_000000/pyarmor_runtime.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
synapse.py
Resource
win11-20240221-en
General
-
Target
index.html
-
Size
5KB
-
MD5
0af3046ee6edfda13b9937e605fb465e
-
SHA1
019bfa006ea2b31e293c4d212012385a47c79be4
-
SHA256
336ef0c1dbcfb6b43e7443c154cdc4f36b7436ec1c370fe49caae080a8df99c5
-
SHA512
ac9d7a442ea7a2b1a96baa3fc2c21ecdcc3bf6427f6f3ccd3e47ac62386e1661a02ca3093c6dc14306260b25d5ac3258b745c80809a902ebaf3dfbf8bfea4134
-
SSDEEP
48:pqNmNyhJgg3YyriumLvt+Z5prqRuYZAoFjAfFi6UFnQB2yr08yWDot9mq4/uR6+B:ADrfmeBWV0BUKB2yo8yWD+9HHB1LL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3896 msedge.exe 3896 msedge.exe 896 msedge.exe 896 msedge.exe 744 msedge.exe 744 msedge.exe 4124 identity_helper.exe 4124 identity_helper.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 896 wrote to memory of 864 896 msedge.exe 79 PID 896 wrote to memory of 864 896 msedge.exe 79 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 1732 896 msedge.exe 81 PID 896 wrote to memory of 3896 896 msedge.exe 82 PID 896 wrote to memory of 3896 896 msedge.exe 82 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83 PID 896 wrote to memory of 2488 896 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc6a573cb8,0x7ffc6a573cc8,0x7ffc6a573cd82⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:22⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,13350139915820739978,7366958269443088944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4868
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD596899614360333c9904499393c6e3d75
SHA1bbfa17cf8df01c266323965735f00f0e9e04cd34
SHA256486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c
SHA512974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7
-
Filesize
152B
MD519a8bcb40a17253313345edd2a0da1e7
SHA186fac74b5bbc59e910248caebd1176a48a46d72e
SHA256b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e
SHA5129f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0
-
Filesize
505B
MD5d30fc9d0dad551d4d4bd43aeac59523b
SHA135c79b53b4201514d0a903840706b9cef7a6b50b
SHA25675315abe278823cd145f6712d98f3a13dd7894f58b8d6e7c86beaf2b684ae14b
SHA5129918369e108b92efad272cdc7fafcebe04b48273d03aedf68a5379ffcdc78b50caf044c87fd9697980c1db5cde8aed2335245b47f25f75f92cc80d0a45f693cf
-
Filesize
6KB
MD518ebe7669ba087fd07e95a33b9e995a7
SHA13eca2a01819c19dfd40dfc616e6a8a837d09d82a
SHA256fd49ff9eb297a608d1408069276de29624381d0087afa2fe95cca6cdd6cc85e5
SHA512849bc58f2004cb8145404c9f5ba1022e8e1962af7ff88843d410e92f75ee8a31b58e4a350faf0e7ec73cd4e9f43c2417453c71b6b7d919fb6009b070315e7f18
-
Filesize
6KB
MD5483dcdecf4682171c13c763bdf6aa29a
SHA188c1e28397466df3963bcdcbf218b44a679d2929
SHA256541056d5082db7da3edeb2bd25d2ad25380310078c719e0caef690109f91a6d6
SHA5122167ce539c743ba5f761a6151d641cf6366b25f00c72796d99b5a66478327bc40b73b9c7fd20bb33f0fa5ab338b25e4c410a62d7bfd0d0d63bc6af5a48c6f6b0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5170332c2fc5eb01dd2013bf27f316204
SHA1fd07defc5984ec2643f89b86ca4787e4978d19bd
SHA2565b8f5f809dcec768842676a4e4bb93c8f7b152d7e7baba9ca74c92be5beb1af3
SHA5127d5d4651deaa0b70ba7db6116d419c5e1e754272446628d416959adcd58788d2392b531116f01f50eddcb0b9da612612b873b185d741a92dbc2810f9eb65dd03